Analyzing...

File Name: OptProReminder.exe

SHA1: 4ffd0c31288174847ff783459040ae67067ef2b8

MD5: e9db090f66ba3479f6f62c2e6e0bc1a3

First Seen Date: 2017-09-14 01:36:19.872101 ( 2017-09-14 01:36:19.872101 )

Number of Clients Seen: 3

Last Analysis Date: 2017-09-18 00:50:54.948201 ( 2017-09-18 00:50:54.948201 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2017-09-18 00:50:54.948201	PUA
Static Analysis Overall Verdict	2017-09-18 00:50:54.948201	No Threat Found
Dynamic Analysis Overall Verdict	2017-09-18 00:50:54.948201	No Threat Found
Precise Detectors Overall Verdict	2017-09-18 00:50:54.948201	PUA

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Suspicious
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Clean
TLS callback functions array detected	Clean

Packer detection on signature database

BobSoft Mini Delphi -> BoB / BobSoft

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Uses a function clandestinely
Has no visible windows

Behavioral Information

QueryFilePath

C:\OptProReminder.exe

C:\Windows\system32\EhStorShell.dll

SetFilePointer

{"lDistanceToMove": "fffff214", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "0", "hFile": "104"}

{"lDistanceToMove": "fffff26b", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "0", "hFile": "104"}

{"lDistanceToMove": "fffff2aa", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "0", "hFile": "104"}

{"lDistanceToMove": "fffffc00", "dwMoveMethod": "2", "lpDistanceToMoveHigh": "0", "hFile": "11c"}

{"lDistanceToMove": "fffffaec", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "0", "hFile": "104"}

{"lDistanceToMove": "fffffbaa", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "0", "hFile": "104"}

{"lDistanceToMove": "fffffc00", "dwMoveMethod": "2", "lpDistanceToMoveHigh": "0", "hFile": "150"}

{"lDistanceToMove": "fffffc20", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "0", "hFile": "104"}

{"lDistanceToMove": "fffff434", "dwMoveMethod": "1", "lpDistanceToMoveHigh": "0", "hFile": "104"}

CreateFile

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\Favorites\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "dwDesiredAccess": "80000000", "dwShareMode": "3"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "\\\\.\\PIPE\\srvsvc", "dwDesiredAccess": "c0000000", "dwShareMode": "3"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming\\Microsoft\\Windows", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming\\Microsoft", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\IconCache.db", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "\\??\\C:\\Windows\\system32\\ntshrui.dll", "dwDesiredAccess": "80", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "\\??\\C:\\Windows\\system32\\EhStorShell.dll", "dwDesiredAccess": "80", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Roaming\\Microsoft\\desktop.ini", "dwDesiredAccess": "80000000", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows", "dwDesiredAccess": "100081", "dwShareMode": "7"}

OpenRegisteryKey

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Borland\\Locales"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Borland\\Locales"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Borland\\Delphi\\Locales"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "SOFTWARE\\Optimizer Pro"}

C:\OptProReminder.EN

comctl32.dll

olepro32.dll

WindowsCodecs.dll

ADVAPI32.dll

ole32.dll

C:\Windows\system32\EhStorShell.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

propsys.dll

C:\Windows\system32\ntshrui.dll

srvcli.dll

cscapi.dll

slc.dll

c:\windows\system32\imageres.dll

C:\Windows\system32\IconCodecService.dll

Mpr.dll

ntmarta.dll

SHELL32.dll

shlwapi.dll

Userenv.dll

netutils.dll

QueryProcessAddress

CreateProcessW

ShellExecuteExW

ShellExecuteW

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Static Precise Trojan Detector 2	2017-09-18 00:50:49.494667	No Match	NotDetected
Static Precise Trojan Detector 3	2017-09-18 00:50:49.507582	No Match	NotDetected
Static Precise Adware InstallCore Detector 1	2017-09-18 00:50:49.527845	No Match	NotDetected
Static Precise Trojan Generic Cryptor Detector 1	2017-09-18 00:50:49.540416	No Match	NotDetected
Static Precise PUA Detector 1	2017-09-18 00:50:49.570308	PUA	Application.Win32.SpeedupMyPC
Static Precise Virus Detector	2017-09-18 00:50:49.571445	No Match	NotDetected
Static Precise Trojan Detector	2017-09-18 00:50:49.571320	No Match	NotDetected
Static Precise Virus Detector 2	2017-09-18 00:50:49.582675	No Match	NotDetected

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5

File Name: OptProReminder.exe

SHA1: 4ffd0c31288174847ff783459040ae67067ef2b8

MD5: e9db090f66ba3479f6f62c2e6e0bc1a3

First Seen Date: 2017-09-14 01:36:19.872101 ( 2017-09-14 01:36:19.872101 )

Number of Clients Seen: 3

Last Analysis Date: 2017-09-18 00:50:54.948201 ( 2017-09-18 00:50:54.948201 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Static Analysis

Packer detection on signature database

Dynamic Analysis

OptProReminder.exe tried to connect to some addresses pinned on the map below (click pins for more details):

Behavioral Information

QueryFilePath

SetFilePointer

CreateFile

OpenRegisteryKey

CreateMutex

OpenMutex

LoadLibrary

QueryProcessAddress

Precise Detectors Analysis Results

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Additional File Information

Vendor Validation

Certificate Validation

PE Headers

PE Sections

PE Imports

PE Exports

PE Resources